Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2149706 (CVE-2021-33621)
| Summary: | CVE-2021-33621 ruby/cgi-gem: HTTP response splitting in CGI | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | caswilli, hhorak, jaruga, jburrell, jorton, kaycoth, ruby-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-06-27 19:29:01 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2149707, 2149708, 2149709, 2149710, 2151262, 2151263, 2151264, 2151265, 2151266, 2151267, 2151268, 2151269, 2189468 | ||
| Bug Blocks: | |||
|
Description
Pedro Sampaio
2022-11-30 16:50:15 UTC
Created ruby tracking bugs for this issue: Affects: fedora-35 [bug 2149707] Affects: fedora-36 [bug 2149710] Created ruby:2.7/ruby tracking bugs for this issue: Affects: fedora-35 [bug 2149708] Created ruby:3.0/ruby tracking bugs for this issue: Affects: fedora-35 [bug 2149709] Note that this CVE is fixed in Ruby to 3.1.3, 3.0.5 or 2.7.7. https://www.ruby-lang.org/en/news/2022/11/24/ruby-3-1-3-released/ https://www.ruby-lang.org/en/news/2022/11/24/ruby-3-0-5-released/ https://www.ruby-lang.org/en/news/2022/11/24/ruby-2-7-7-released/ This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2023:3291 https://access.redhat.com/errata/RHSA-2023:3291 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:3821 https://access.redhat.com/errata/RHSA-2023:3821 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-33621 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:7025 https://access.redhat.com/errata/RHSA-2023:7025 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:1431 https://access.redhat.com/errata/RHSA-2024:1431 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:1576 https://access.redhat.com/errata/RHSA-2024:1576 |